Cryptographic validity answers one question: was this artifact issued by who it claims? It says nothing about whether the payment should happen.
Three real gaps sit between "signature verifies" and "safe to settle":
The mandate may be honest and stale. Standing authorization
delegated to an agent's key (cnf) outlives the moment it was
meant for. If the protocol only recommends bounding
exp rather than requiring it, an unbounded mandate is valid
forever — including after the agent's key is compromised. Valid
signature, attacker-controlled intent.
The mandate may be consumed and still valid. Closing a mandate and retiring it are different operations. If verifiers don't enforce single-use, the same artifact replays — valid signature, duplicate settlement.
The mandate may be valid and wrong. Constraints are only as strong as their evaluation: an amount within bounds, a currency the mandate never authorized, a merchant category outside scope — each passes signature verification and fails policy.
Verification is the floor, not the ceiling. The decision that matters — should this specific payment occur, right now, under this delegation — requires risk context, revocation state, and consumption state that no signature carries.
Related public issue: AP2 #386 — revocation path for open mandates.
Series rubric: APAF-1 — Agent Payment Assurance Framework. ← All research